Bona Fide Data Processing Addendum

Effective date: 19 October 2026 · Last updated: 19 October 2026

This Data Processing Addendum (“DPA”) forms part of the Bona Fide Terms of Service or other agreement (the “Agreement”) between The Republic US LLC, 16192 Coastal Highway, Lewes, Delaware 19958, USA (“Bona Fide”, “Processor”) and the customer (“Customer”). It applies automatically when Customer accepts the Agreement.

1. Definitions

Terms such as “controller”, “processor”, “personal data”, “processing”, “data subject”, “personal data breach” and “supervisory authority” have the meanings given in the GDPR. “Data Protection Laws” means all laws that apply to the processing of Customer Personal Data under the Agreement, including Regulation (EU) 2016/679 (“GDPR”), the GDPR as it forms part of UK law and the UK Data Protection Act 2018 (“UK GDPR”), the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended by the CPRA (“CCPA”), and other US state privacy laws. “Customer Personal Data” means personal data in Customer Content (as defined in the Terms) that Bona Fide processes on Customer’s behalf. “Sub-processor” means a third party engaged by Bona Fide that processes Customer Personal Data. “SCCs” means the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914. “UK Addendum” means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0, in force 21 March 2022, as amended).

2. Roles and scope

2.1 Customer is the controller (or a processor acting for its own customers) and Bona Fide is the processor (or sub-processor) of Customer Personal Data. Under the CCPA, Bona Fide is Customer’s “service provider”.

2.2 The subject matter, nature, purpose and duration of the processing, and the categories of data and data subjects, are described in Annex I.

2.3 This DPA does not apply to data Bona Fide processes as a controller (account, billing, website data), which is covered by the Privacy Policy.

3. Customer instructions

3.1 Bona Fide processes Customer Personal Data only on Customer’s documented instructions. The Agreement, Customer’s configuration of the Services (for example envelopes, recipients, verification methods, branding, retention, webhook and API calls) and this DPA are Customer’s complete instructions. Additional instructions require written agreement.

3.2 Bona Fide will inform Customer if, in its opinion, an instruction infringes Data Protection Laws, unless the law prohibits this.

3.3 Customer is responsible for the lawfulness of the processing, including having a legal basis, giving notices to recipients and signers, and obtaining any consent required (including consumer consent to electronic records).

3.4 Evidence and verification. Customer instructs Bona Fide to: (a) record the audit trail described in Annex I; (b) append a certificate of completion to signed documents; (c) send document hashes (no content) to third-party timestamp authorities; (d) include each completed envelope’s fingerprints in the hourly public anchor log; (e) answer public verification requests for a submitted file hash by showing the completion date and partly masked signer email addresses; and (f) process signing-page security and device data to prevent abuse of the Services.

4. CCPA service-provider terms

Bona Fide will not: sell or share Customer Personal Data; retain, use or disclose it for any purpose other than the business purposes in the Agreement (including for a commercial purpose other than providing the Services); retain, use or disclose it outside the direct business relationship with Customer; or combine it with personal information it receives from other sources, except as the CCPA permits. Bona Fide will comply with the CCPA, provide the same level of protection the CCPA requires, notify Customer if it can no longer meet its obligations, and allow Customer to take reasonable steps to stop and remediate unauthorized use.

5. Confidentiality and personnel

Bona Fide ensures that personnel authorized to process Customer Personal Data are bound by confidentiality obligations and access it only as needed to provide, secure and support the Services. Staff access to customer workspaces through the admin console is limited to authorized staff, protected by strong authentication and session limits, and logged.

6. Security

Bona Fide implements the technical and organizational measures in Annex II. Bona Fide may update them, provided the overall level of security is not reduced.

7. Sub-processors

7.1 Customer gives general authorization for Bona Fide to engage Sub-processors. The current list is published at bonafidesign.com/legal/subprocessors/.

7.2 Bona Fide will give at least 30 days’ notice of a new Sub-processor by updating the list and notifying Customer’s workspace owners by email. Customer may object on reasonable data protection grounds within that period. The parties will discuss in good faith; if no solution is found, Customer may terminate the affected Services and receive a refund of prepaid unused fees. In an emergency (for example to keep the Services secure or available), a shorter notice may apply, with notice as soon as possible.

7.3 Bona Fide imposes data protection obligations on each Sub-processor that are no less protective than this DPA, and remains liable for its Sub-processors’ performance as required by Data Protection Laws.

8. Assistance

8.1 Data subject requests. Bona Fide will promptly forward to Customer any request from a data subject about Customer Personal Data and will not respond except to confirm the request was forwarded. Taking into account the nature of the processing, Bona Fide will assist Customer through the Services’ features (for example export, void and delete via the dashboard and API) and, where those are insufficient, on request.

8.2 DPIAs and authorities. Bona Fide will provide reasonable information to help Customer carry out data protection impact assessments and prior consultations with supervisory authorities.

9. Personal data breaches

Bona Fide will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as known, the nature of the breach, categories and approximate numbers of data subjects and records, likely consequences, and measures taken or proposed. Bona Fide will take reasonable steps to contain and remediate the breach. Notification is not an admission of fault.

10. Deletion and return

Customer can export documents, certificates of completion and audit data at any time during the term. Within 30 days after termination of the Agreement (or earlier on Customer’s instruction), Bona Fide will delete Customer Personal Data, except: (a) copies in encrypted backups, which expire within 35 days and are not restored except for disaster recovery; (b) data that must be retained by law; and (c) fingerprints already included in published anchors, which by design cannot be removed and contain no personal data. Bona Fide will confirm deletion in writing on request.

11. Audits

Bona Fide will make available information reasonably necessary to demonstrate compliance with Art. 28 GDPR, such as this DPA, security documentation and, if and when available, third-party audit reports. If that is not sufficient, or if a supervisory authority requires it, Customer may conduct an audit no more than once a year, with at least 30 days’ notice, during business hours, under confidentiality, at Customer’s cost, and in a way that does not compromise the security of other customers.

12. International transfers

12.1 Bona Fide processes Customer Personal Data in a dedicated Kubernetes cluster that it operates, and through the Sub-processors, in the locations listed on the Sub-processors page.

12.2 EEA. To the extent Customer Personal Data is transferred from the EEA to Bona Fide in a country without an adequacy decision, the SCCs are incorporated by reference and apply as follows: Module Two (controller to processor) where Customer is a controller, and Module Three (processor to processor) where Customer is a processor; Clause 7 (docking clause) applies; Clause 9 option 2 (general authorization) applies with the notice period in Section 7.2; the optional wording in Clause 11 does not apply; Clause 17 option 1, governed by the law of Ireland; Clause 18, courts of Ireland; Annexes I to III are completed by the Annexes to this DPA.

12.3 UK. For transfers subject to the UK GDPR, the UK Addendum applies, with Table 1 completed with the parties’ details in this DPA, Table 2 referring to the SCC modules and options above, Table 3 to the Annexes of this DPA, and in Table 4 both the importer and the exporter may end the UK Addendum as set out in its Section 19.

12.4 Switzerland. For transfers subject to Swiss law, the SCCs apply with the references to the GDPR read as the Swiss FADP, the competent authority being the Swiss FDPIC, and the term “member state” not being interpreted to exclude data subjects in Switzerland.

12.5 Transfer mechanism. Transfers of Customer Personal Data to Bona Fide rely on the SCCs, the UK Addendum and the Swiss amendments as set out in this Section 12.

12.6 Government access. Bona Fide will notify Customer of legally binding requests from public authorities for Customer Personal Data, unless prohibited, challenge requests it reasonably considers unlawful, and disclose only the minimum required.

13. Liability and precedence

Each party’s liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Laws or the SCCs do not allow it. If this DPA conflicts with the Agreement, this DPA prevails for data protection matters; if it conflicts with the SCCs, the SCCs prevail.

Annex I – Description of the processing

A. Parties

• Data exporter: Customer (controller or processor), as identified in its account. Contact: the workspace owner.
• Data importer: The Republic US LLC (Bona Fide), 16192 Coastal Highway, Lewes, Delaware 19958, USA · contact@bonafidesign.com (data protection matters: please put “Privacy” in the subject line) · role: processor.

B. Description

C. Competent supervisory authority: determined in accordance with Clause 13(a) of the SCCs: where Customer is established in an EU Member State, the supervisory authority competent for Customer; where Customer is not established in the EU but has appointed a representative under Art. 27(1) GDPR, the supervisory authority of the Member State in which that representative is established; otherwise, the supervisory authority of one of the Member States in which the data subjects whose personal data is transferred are located.

Annex II – Technical and organizational measures

1. Encryption in transit: TLS for all public endpoints (terminated by Cloudflare); signing access tokens kept in memory, not in cookies.
2. Encryption at rest: webhook signing secrets encrypted with a dedicated data-encryption key; API keys and SCIM tokens stored as hashes; database backups encrypted (age) before leaving the cluster.
3. Integrity and evidence: per-envelope hash-chained audit log; SHA-256 of every original and sealed document; check of the viewed-document hash at submit; PAdES document timestamps with long-term validation data; hourly Ed25519-signed Merkle anchors chained to the previous anchor.
4. Access control: passwordless sign-in options, passkeys, SSO/SAML and SCIM, enforced SSO on Business and above; role-based workspace permissions; scoped and expiring API keys; staff admin console restricted to listed staff accounts with re-authentication every 12 hours and 8-hour sessions.
5. Password security: 12–128 characters; breached passwords rejected (k-anonymity check); per-IP and per-address rate limits.
6. Network and isolation: document conversion and sealing run as separate services with restrictive network policies (the converter has no internet egress); internal requests signed with shared secrets.
7. Abuse prevention: Cloudflare WAF and Turnstile bot checks; rate limits on public, sign-in and one-time-code endpoints; reporting address security@bonafidesign.com in every email.
8. Availability and resilience: physical database backups with continuous WAL streaming (point-in-time restore) to encrypted off-site storage; queued jobs with retries.
9. Secure development: code review, automated tests and CI, pinned dependencies, secrets managed outside code (SOPS-encrypted in the GitOps repository).
10. Logging and monitoring: application logs; admin actions logged.
11. Incident response: documented process, breach notification per Section 9.
12. Data minimization: timestamp authorities and the public anchor log receive hashes only; the verification page hashes files in the browser.

Annex III – Sub-processors

See the Sub-processors page.

Published in English, which is the governing version. Questions: contact@bonafidesign.com. The Republic US LLC, 16192 Coastal Highway, Lewes, Delaware 19958, USA · +1 302 984 7474